Back up Pulumi stack state

Use this when state lives on Pulumi Cloud (including ephemeral agent accounts) and you need an offline copy, or when moving off SaaS invites entirely.

Export a checkpoint (always works)

From the org infra repo:

pulumi stack select <stack>
pulumi stack export --file pulumi-state-<org>-<stack>.json

  • Default export redacts secrets. Add --show-secrets only on a locked machine when you intentionally need plaintext recovery material.

  • Import later with pulumi stack import --file … into a stack on the destination backend.

  • An export of a never-applied stack is nearly empty JSON — still worth keeping after the first successful pulumi up.

Schedule exports (Task Scheduler / cron / CI artifact) after every production apply if you stay on Pulumi Cloud Individual.

Prefer: self-managed backend (team without Team Edition)

Skip Pulumi Cloud membership entirely:

# Object storage (examples)
pulumi login s3://your-company-pulumi-state
pulumi login gs://your-company-pulumi-state

# Local or synced directory (single operator or carefully shared path)
pulumi login file:///path/to/pulumi-state
pulumi login --local

Then collaboration is IAM + Git, not Pulumi invites. You must back up that bucket or directory yourself.

Read Pulumi secrets vs stack state if you expected the git repo alone to remember live Cloudflare resource IDs.

GUIs when rclone feels hostile

rclone is powerful and opaque. You do not have to live in the CLI. Options (not all tested here — pick one and try):

Tool Fit Notes

RcloneView

GUI over rclone

Browse/sync/mount; multi-provider. Evaluate free vs paid tiers yourself.

Cyberduck

Free open-source browser

S3, B2, Drive, many protocols. Same family as Mountain Duck.

Mountain Duck

Mount as a drive

Finder / Explorer mount; Backblaze documents B2 + S3-style clients in this class.

S3 Browser

Windows S3/B2-style buckets

Object-storage focused (not Google Drive).

AlternativeTo: rclone

Survey

Community list of GUIs and sync tools — use when shopping; verify license and malware like any download portal.

Backblaze’s own docs and marketing commonly point people at Cyberduck, Mountain Duck, and similar S3/B2 GUIs rather than raw rclone. Prefer those if Drive is only a temporary landing zone and B2/R2 will hold Pulumi state.

Google Drive as an export landing zone

Drive is a reasonable offline copy of pulumi stack export JSON. It is not a supported Pulumi state backend (do not pulumi login to Drive).

Options that fit this workstation:

Tool Role

rclone (multi-provider object/storage CLI)

Preferred local CLI for Drive, S3, Spaces, R2, B2, etc. Known remotes on this machine include gdrive: and digitalocean-spaces:. Example: rclone copy ./pulumi-state-*.json gdrive:"Pulumi backups/nonprofit-resources/". Good for scheduled jobs and for syncing a file:// Pulumi backend directory to a remote.

Composio Google Drive (MCP / agents)

Same Drive account from Cursor agents; create folders / upload export JSON when rclone is awkward in-session. Founder Drive already has Pulumi backups.

DevCentr RepoDrive (repodrive)

Unrelated — forge-repo virtual filesystem, not cloud object storage.

Suggested Drive layout (founder Drive already has Pulumi backups with a nonprofit-resources/ child):

Pulumi backups/
  nonprofit-resources/
    nonprofit-resources-infra-prod-YYYYMMDD.json
  foodtrucknerdz/
    …

Treat exports as sensitive (resource IDs, sometimes secret ciphertext). Keep the folder private; do not attach exports to public issues.

Migrating off an ephemeral agent account

  1. Export every stack: pulumi stack export --file …

  2. Claim the agent account or log in as your lasting Individual user / point pulumi login at object storage

  3. pulumi stack init (if needed) + pulumi stack import --file …

  4. Confirm pulumi preview is clean before the next apply

  5. Upload the same export JSON to Drive as a dated backup

See Pulumi Cloud org model for why free Organizations/invites are not the escape hatch.

Related